Safecracking for Everyone

Safecracking for Everyone

Speakers: Jared Dygert

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=6qTLxglm2fs

Overview

In "Safecracking for Everyone" at DEF CON 32, Jared Dygert, a seasoned lock sport enthusiast and safe manipulation expert, peeled back the layers of security surrounding common mechanical safe locks. His talk delivered a stark message: the vast majority of mechanical safes, particularly those categorized as Group 2, offer virtually no resistance to a skilled manipulator. Dygert not only demystified the inner workings of these ubiquitous locking mechanisms but also exposed their fundamental design flaws and provided a detailed methodology for exploiting them.

The presentation challenged prevailing notions of safe security, asserting that even supposedly "high-security" Group 1 locks, which are rated to withstand manipulation for a minimum of 20 hours, are fundamentally flawed and easily compromised. Dygert's objective was to disseminate knowledge about these vulnerabilities, making the art and science of safe manipulation accessible and understandable to a broader audience, thereby fostering a deeper appreciation for true security in physical access controls.

This talk is crucial for anyone who relies on mechanical safe locks—from homeowners protecting valuables to businesses securing sensitive documents. Dygert's insights highlight a significant disconnect between perceived security and actual resilience against non-destructive entry techniques. By revealing the inherent weaknesses in these systems, the talk serves as a critical educational piece for both security professionals and the general public, urging a reevaluation of physical security strategies.

Background

The world of mechanical safe locks is categorized by a classification system intended to denote varying levels of security. Jared Dygert's talk primarily focused on Group 2 mechanical safe locks, which he identified as the standard for most consumer and commercial safes equipped with a dial combination. These locks represent the lowest tier in the security hierarchy. Above Group 2 are Group 2M locks, which incorporate minor improvements designed to make manipulation more challenging, though Dygert implies these improvements are often insufficient. At the apex of this classification system lies Group 1, designated as "high security," boasting additional features and a purported ability to resist manipulation for a minimum of 20 hours. A specialized variant, Group 1R, offers the same security as Group 1 but with added radiological resistance, achieved by using low-density plastics like Delrin for internal components to thwart X-ray attacks.

Dygert, however, presented a critical assessment of this entire classification scheme, unequivocally stating that the claimed resistance of Group 1 locks is "completely false" and that he doesn't "actually understand why they have different groups cuz they all kind of suck at the moment." This assertion sets the stage for his deep dive into the underlying mechanical principles and their inherent weaknesses.

At the heart of a mechanical safe lock is a system of interconnected components designed to register a specific numerical combination. The primary components include the dial, which the user rotates to input numbers; the drive cam, a large brass circle with a cutout, directly connected to the dial; a lever with a protrusion called a nose, which rests on the drive cam; and a series of wheels (typically three for a three-number combination), each featuring a gate—a precisely cut notch. Behind the lever and above the wheels is a bar known as the fence.

The operational sequence begins with the dial turning the drive cam. The drive cam, in turn, has a protrusion that engages a drive pin on the outermost wheel (referred to as the third wheel). As the drive cam rotates, it "picks up" this wheel. Each subsequent wheel also has a drive pin that engages a groove on the wheel behind it, allowing all wheels to be moved together once engaged. To set a combination, the dial is rotated multiple times in one direction to engage all wheels, then reversed to disengage them one by one, allowing each wheel's gate to be individually aligned. The correct combination is achieved when all the wheels' gates are perfectly aligned beneath the fence. When this alignment occurs, the nose of the lever, which normally rides on the outer edge of the drive cam, drops into the drive cam's cutout. Simultaneously, the fence falls into the aligned gates of the wheels, allowing the safe's bolt to be retracted and the door to open. The problem, as Dygert explains, lies in the subtle imperfections and design choices within this seemingly robust mechanism.

Key Findings

Jared Dygert's central finding, and the core vulnerability he exploits, is the asymmetry of the drop-in area on the drive cam in Group 2 mechanical safe locks. This critical design flaw provides a tactile signature that can be leveraged to non-destructively determine the safe's combination. As the dial is rotated, the lever's nose rides along the outer edge of the drive cam. When it encounters the cutout—the "drop-in area"—the nose will drop ever so slightly.

The key insight is that this drop-in area is not symmetrical. One side of the cutout exhibits a "great curve," leading to a varying amount of "wiggle room" or lateral movement available to the nose as it descends into the drop-in. Specifically, Dygert notes that "the further down we go in this drop in point, there is less wiggle room from one side to the other is significantly less than up high. There's much more wiggle room up there." This measurable difference in lateral play, felt as the contact points where the nose hits the walls of the drop-in area, serves as a precise indicator for the manipulator. By carefully measuring the distance between these contact points on the dial, a skilled individual can determine the exact rotational position of the drive cam relative to the nose's descent, and consequently, the alignment of the wheels.

Furthermore, Dygert's talk revealed a broader, more systemic issue within the safe lock industry: the overestimation of security offered by higher-tier locks. His assertion that the purported 20-hour manipulation resistance of Group 1 high-security locks is "completely false" underscores a significant gap between marketing claims and practical exploitability. He argues that the fundamental flaws present in Group 2 locks often persist in Group 1 designs, or that additional security features are easily bypassed, rendering the classifications largely ineffective against a determined and knowledgeable attacker. This finding suggests that the entire classification system for mechanical safe locks may create a false sense of security for consumers and organizations.

Technical Deep Dive

The manipulation of a mechanical safe lock, as detailed by Jared Dygert, hinges on the precise interpretation of tactile feedback derived from the lock's internal mechanics. The process begins with understanding how the components interact and, crucially, how their imperfections can be exploited.

The drive cam, directly connected to the dial, acts as the primary driver. It features a protrusion that engages the drive pin of the outermost wheel (the third wheel in a three-wheel system). As the dial is turned, the drive cam carries this wheel along. Each subsequent wheel, in turn, has its own drive pin that engages a corresponding groove on the wheel positioned behind it. This interlocking mechanism ensures that by rotating the dial sufficiently, all wheels can be "picked up" and moved together. A critical nuance here is that if the rotation direction is reversed, a full rotation is often required to re-engage the drive pins, ensuring all wheels are properly coupled before proceeding with manipulation. This sequential engagement allows for the individual setting of each wheel's position by reversing direction at specific points on the dial.

The core of the manipulation technique lies in the lever and its nose, which rests upon the drive cam. As the dial spins, the nose glides over the smooth surface of the drive cam until it encounters the drop-in area—the cutout designed to allow the nose to fall when the combination is correct. The critical vulnerability, as Dygert explains, is the asymmetrical nature of this drop-in area. One side of the cutout has a distinct curve, meaning that the lateral "wiggle room" of the nose varies depending on how deeply it has dropped into the cutout. When the nose is higher in the drop-in, there is more lateral play, indicating a wider span between the points where the nose makes contact with the walls of the cutout. Conversely, when the nose is lower in the drop-in, this lateral play significantly diminishes, indicating a narrower span between the contact points.

This phenomenon enables the contact point reading technique. A manipulator will turn the dial to locate the points where the nose first hits the "walls" of the drop-in area on either side. These are the "contact points." By carefully measuring the angular distance between these two contact points on the dial, the manipulator obtains a "reading." A wider reading indicates the nose is higher in the drop-in, while a narrower reading indicates it's lower. The goal is to find the "center" of the drop-in point, where the nose is at its lowest and the contact point reading is at its narrowest, as this corresponds to the wheel's gate being most accurately aligned.

The process for finding the combination typically involves isolating and setting each wheel individually. To find the first number of a three-number combination, the manipulator would first ensure all wheels are engaged. Then, they would manipulate the dial and apply slight pressure to the lever, feeling for the variations in contact point readings. By systematically rotating the dial and observing how the contact points change, they can deduce the position of the outermost wheel's gate. This is a subtle, tactile process that relies on highly developed proprioception and a deep understanding of the lock's internal geometry.

Once the position of one wheel's gate is determined and set, the manipulator then employs a specific sequence of rotations to "pick up" the next wheel while leaving the first one undisturbed. This allows them to repeat the contact point reading process for the second wheel, and then the third. The challenge is compounded by manufacturing imperfections. Dygert notes that wheels are "not necessarily larger or smaller than the other wheels. They can be bumpy or irregularly shaped." These irregularities can create "false gates" or prevent the fence (the bar that drops into the aligned gates) from falling completely, leading to ambiguous readings that require careful interpretation and cross-referencing. The manipulator must find the "true" combination by centering the drop-in point as accurately as possible, even in the presence of these mechanical anomalies.

The overall methodology is one of iterative refinement, where each wheel's position is isolated and determined through painstaking tactile analysis of the drive cam's asymmetrical drop-in and the resulting contact point readings. This methodical approach systematically reduces the vast number of possible combinations to a single, functional sequence, demonstrating that the "security" of Group 2 (and even Group 1) locks is often an illusion.

Demo / Proof of Concept

During the live presentation, Jared Dygert intended to provide a visual demonstration of the lock's internal mechanics and the manipulation process. He referenced slides displaying internal components like the drive cam, lever, nose, wheels, and fence, and attempted to use a camera to show a physical example. However, due to technical difficulties with the camera setup, a full live demonstration was not possible in the manner he had hoped.

Despite the on-stage technical hitches, Dygert compensated by describing the mechanical interactions in detail, referring to prepared visual aids. He provided a conceptual example using an analogy of a black piece representing the drive cam and other pieces as wheels to illustrate how the drive cam's protrusion engages the drive pin of each wheel sequentially. He further assured the audience that in-person demonstrations, where attendees could "try yourself," would be available immediately after the talk at the Lockpicking Village. This hands-on opportunity would have allowed for a practical, tactile proof-of-concept for those interested in experiencing the manipulation techniques firsthand. Furthermore, Dygert made available a comprehensive PDF guide, hosted on Google Drive, which includes detailed information on high-security safe manipulation, stating that this book is "the only place of that information" publicly available. This resource serves as a persistent, detailed proof-of-concept for the methods discussed.

Defensive Implications

The findings presented by Jared Dygert carry significant defensive implications for anyone relying on mechanical safe locks. The primary takeaway is that Group 2 mechanical safe locks, which constitute the vast majority of mechanical safes sold, offer extremely low security against skilled manipulation. Dygert's assertion that "there is absolutely nothing preventing anyone from figuring out the combination" for these locks means they should not be considered secure for protecting high-value assets or sensitive information against a dedicated attacker.

Even the supposedly "high-security" Group 1 locks are fundamentally flawed. Dygert's dismissal of their advertised 20-hour manipulation resistance as "completely false" indicates that the industry's classification standards are misleading and do not reflect real-world vulnerabilities. This implies that simply upgrading to a Group 1 lock may not provide the expected exponential increase in security, as the underlying manipulation principles often remain effective. The existence of Group 1R locks, designed with Delrin plastic parts to resist X-ray attacks, highlights that certain advanced attack vectors are known and addressed, yet Dygert's overall critique suggests these specific countermeasures do not fundamentally alter the locks' susceptibility to other forms of manipulation.

For defenders, this talk necessitates a critical re-evaluation of physical security protocols:

1. Audit Existing Safes: Organizations and individuals should identify the classification of their mechanical safe locks. If they are Group 2, or even Group 1, they should be considered highly vulnerable to non-destructive manipulation.
2. Consider Electronic Locks: While not without their own vulnerabilities, modern electronic safe locks, particularly those with features like time delays, audit trails, and multi-factor authentication, can offer different security profiles that may be harder to bypass with purely mechanical manipulation techniques.
3. Layered Security: Relying solely on a mechanical safe lock is insufficient. Implement a layered security approach that includes alarm systems, surveillance, access control, and robust physical barriers around the safe itself. Time is a crucial factor; even if a safe can be manipulated, increasing the time and effort required (e.g., by placing it in a secure vault) can deter attackers.
4. Awareness and Training: Security personnel should be aware of the inherent weaknesses of mechanical safe locks and understand that a locked safe does not automatically equate to a secure safe. This knowledge can inform incident response and risk assessment strategies.
5. Professional Consultation: For high-security applications, consult with specialized physical security experts who are knowledgeable about advanced safe technologies and manipulation resistance. They can recommend locks certified to higher, more realistic standards (e.g., TL-rated safes that resist specific tool attacks) or suggest alternative security solutions.

Ultimately, Dygert's talk serves as a call to action: understand the true limitations of mechanical safe locks and implement comprehensive security measures that account for their inherent vulnerabilities, rather than relying on outdated or overly optimistic industry classifications.

Key Takeaways

• Group 2 mechanical safe locks are inherently insecure and offer minimal protection against non-destructive manipulation, making them highly vulnerable to skilled attackers.
• The primary vulnerability is the asymmetrical design of the drive cam's drop-in area, which allows manipulators to use contact point readings to precisely determine wheel positions.
• Even "high-security" Group 1 locks are fundamentally flawed, and their advertised resistance to manipulation (e.g., 20 hours) is "completely false," challenging the industry's classification system.
• Manipulation involves a methodical, tactile process of isolating each wheel, interpreting subtle feedback from the dial, and measuring variations in "wiggle room" to locate the true alignment of each wheel's gate.
• Defenders should re-evaluate their reliance on mechanical safe locks, consider alternative security measures, and implement layered security strategies to compensate for these known vulnerabilities.
• Detailed technical information on safe manipulation, including high-security locks, is available through resources provided by the speaker, highlighting the accessibility of this knowledge.

About the Speaker(s)

Jared Dygert is a dedicated lock sport enthusiast with extensive experience in the field. He has been actively picking locks for nearly 20 years and delved into safe manipulation approximately 15 years ago, establishing himself as a seasoned expert in non-destructive entry techniques. Beyond his security pursuits, Dygert identifies as a passionate gamer and, notably, works as a professional rock climber, which he states is his "main source of income at the moment." His unique blend of tactile skill, patience, and analytical thinking from both rock climbing and lock sport undoubtedly contributes to his proficiency in safe manipulation. Dygert is also the author of a comprehensive guide on high-security safe manipulation, which he claims is the only publicly available resource for such detailed information.